CVE-2026-67347mediumCWE-863

CVE-2026-67347: medium-severity vulnerability in vendurehq vendure

Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Published · Updated

Follow this CVE+ Monitor vendure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.1epss 0.5%
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
vendurehq · vendure
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — vendurehq vendure

In the same product, most dangerous first.

CVE-2026-40887CRITICAL@vendure/core has a SQL Injection vulnerabilityEPSS 1.8%CVE-2026-63460HIGHVendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsEPSS 0.6%CVE-2026-63472CRITICALVendure: External-authentication account takeover: external login linked to a pre-existing account by email without verificationEPSS 0.6%CVE-2026-63461MEDIUMVendure: Shop API list queries can return non-public entities when filterOperator is OREPSS 0.4%CVE-2026-63459HIGHVendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsEPSS 0.4%CVE-2026-25050LOWVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyEPSS 0.4%